CISA KEV · September 2026
In September 2026, CISA added 43 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, up from 31 in August 2026. None are known to be used in ransomware campaigns. The most affected vendors were Cisco (4), Citrix (3), MikroTik (3). Every entry below has reliable evidence of exploitation in the wild, so if you run the product, patch or mitigate it first.
| Added | CVE | Vulnerability | Federal due |
|---|---|---|---|
| 30 Sep 2026 | CVE-2026-76504 | Cisco Catalyst SD-WAN Manager Hex Encoding VulnerabilityCisco · Catalyst SD-WAN Manager | |
| 29 Sep 2026 | CVE-2026-86950 | Apple Multiple Products Out-of-Bounds Write VulnerabilityApple · Multiple Products | |
| 27 Sep 2026 | CVE-2026-88772 | Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer VulnerabilityCitrix · NetScaler | |
| 27 Sep 2026 | CVE-2026-88771 | Citrix NetScaler Improper Input Validation VulnerabilityCitrix · NetScaler | |
| 25 Sep 2026 | CVE-2026-87902 | WordPress Core Remote File Inclusion VulnerabilityWordPress · Core | |
| 25 Sep 2026 | CVE-2026-67279 | Mikrotik RouterOS Improper Enforcement of Behavioral Workflow VulnerabilityMikroTik · RouterOS | |
| 25 Sep 2026 | CVE-2026-65660 | Microsoft SharePoint Code Injection VulnerabilityMicrosoft · SharePoint | |
| 24 Sep 2026 | CVE-2026-71362 | Adobe Commerce and Magento Incorrect Authorization Vulnerability Adobe · Commerce and Magento | |
| 24 Sep 2026 | CVE-2026-5430 | WSO2 Multiple Products Path Traversal Vulnerability WSO2 · Multiple Products | |
| 22 Sep 2026 | CVE-2026-94127 | F5 BIG-IP APM Heap-based Buffer Overflow VulnerabilityF5 · BIG-IP APM | |
| 22 Sep 2026 | CVE-2026-93952 | Arista VeloCloud Orchestrator Improper Input Validation VulnerabilityArista · VeloCloud Orchestrator | |
| 22 Sep 2026 | CVE-2026-93616 | Check Point Multiple Products Path Traversal VulnerabilityCheck Point · Multiple Products | |
| 22 Sep 2026 | CVE-2026-85102 | Check Point Multiple Products Improper Certificate Validation VulnerabilityCheck Point · Multiple Products | |
| 21 Sep 2026 | CVE-2026-7273 | Zyxel GS1900 Series Switches Stack-Based Buffer Overflow VulnerabilityZyxel · GS1900 Series Switches | |
| 18 Sep 2026 | CVE-2026-53266 | Linux Kernel Out-of-Bounds Write VulnerabilityLinux · Kernel | |
| 18 Sep 2026 | CVE-2025-39964 | Linux Kernel Race Condition VulnerabilityLinux · Kernel | |
| 18 Sep 2026 | CVE-2025-39682 | Linux Kernel Improper Check for Unusual or Exceptional Conditions VulnerabilityLinux · Kernel | |
| 16 Sep 2026 | CVE-2026-87886 | Acronis Backup Incorrect Default Permissions VulnerabilityAcronis · Backup | |
| 16 Sep 2026 | CVE-2026-76460 | Cisco Identity Services Engine Incorrect Use of Privileged APIs VulnerabilityCisco · Identity Services Engine | |
| 16 Sep 2026 | CVE-2026-58704 | Google Pixel Improper Authorization VulnerabilityGoogle · Pixel | |
| 14 Sep 2026 | CVE-2026-76461 | Cisco Secure Email Gateway SQL Injection VulnerabilityCisco · Secure Email Gateway | |
| 11 Sep 2026 | CVE-2026-85706 | GitLab Community Edition and Enterprise Edition Path Traversal VulnerabilityGitLab · Community Edition and Enterprise Edition | |
| 11 Sep 2026 | CVE-2026-84869 | ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization VulnerabilityConnectWise · ScreenConnect | |
| 11 Sep 2026 | CVE-2026-42018 | JFrog Artifactory Improper Authentication VulnerabilityJFrog · Artifactory | |
| 11 Sep 2026 | CVE-2026-42016 | JFrog Artifactory Incorrect Authorization VulnerabilityJFrog · Artifactory | |
| 10 Sep 2026 | CVE-2026-86060 | MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command VulnerabilityMikroTik · RouterOS | |
| 10 Sep 2026 | CVE-2026-67277 | MikroTik RouterOS Missing Authentication for Critical Function VulnerabilityMikroTik · RouterOS | |
| 9 Sep 2026 | CVE-2026-87491 | Google Chromium V8 Out of Bounds Write VulnerabilityGoogle · Chromium V8 | |
| 9 Sep 2026 | CVE-2026-20079 | Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel VulnerabilityCisco · Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management | |
| 9 Sep 2026 | CVE-2026-19490 | Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel VulnerabilityCitrix · NetScaler | |
| 9 Sep 2026 | CVE-2025-25249 | Fortinet Multiple Products Heap-based Buffer Overflow VulnerabilityFortinet · Multiple Products | |
| 8 Sep 2026 | CVE-2026-86218 | N-able N-central Static Code Injection VulnerabilityN-able · N-central | |
| 8 Sep 2026 | CVE-2026-85880 | Microsoft Windows Heap-Based Buffer Overflow VulnerabilityMicrosoft · Windows | |
| 8 Sep 2026 | CVE-2026-81963 | Microsoft Windows Link Following VulnerabilityMicrosoft · Windows | |
| 8 Sep 2026 | CVE-2026-75650 | Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine VulnerabilityAdobe · Commerce and Magento | |
| 4 Sep 2026 | CVE-2026-85046 | Google Chromium V8 Type Confusion VulnerabilityGoogle · Chromium V8 | |
| 2 Sep 2026 | CVE-2026-9586 | Sangoma Switchvox SQL Injection VulnerabilitySangoma · Switchvox | |
| 2 Sep 2026 | CVE-2026-83549 | SonicWall SMA1000 Appliances OS Command Injection VulnerabilitySonicWall · SMA1000 Appliances | |
| 2 Sep 2026 | CVE-2026-83548 | SonicWall SMA1000 Appliances Server-Side Request Forgery VulnerabilitySonicWall · SMA1000 Appliances | |
| 2 Sep 2026 | CVE-2026-82329 | JFrog Artifactory Improper Authentication VulnerabilityJFrog · Artifactory | |
| 2 Sep 2026 | CVE-2026-59822 | BerriAI LiteLLM Improper Authentication VulnerabilityBerriAI · LiteLLM | |
| 2 Sep 2026 | CVE-2026-49869 | Kestra OSS OS Command Injection VulnerabilityKestra · Kestra OSS | |
| 2 Sep 2026 | CVE-2026-48710 | Kludex Starlette HTTP Request/Response Smuggling VulnerabilityKludex · Starlette |
Run your vendors and products through stack check, pre-filled with this month's vendors; it also gives you an RSS feed for new additions. The long-run picture is on CVE Trends.
43 vulnerabilities. In August 2026 it added 31.
Cisco, with 4 entries. Next were Citrix (3), MikroTik (3), Microsoft (3).
It is the US Cybersecurity and Infrastructure Security Agency's list of vulnerabilities with reliable evidence of exploitation in the wild, currently 1,767 entries. US federal agencies must fix listed vulnerabilities by the due date; for everyone else it is the best public list of what to patch first.
How this is made: generated automatically from the CISA KEV catalog, grouped by the date CISA added each entry. Vulnerability names are CISA's. Federal due dates apply to US agencies under BOD 22-01; for everyone else they are a sensible upper bound.
We wire CISA KEV and EPSS into your scanner, SIEM and ticketing, so your team sees the few entries that match your estate, with deadlines an auditor accepts.
Get in touch →